Quad9 DNS over TLS intercepted by Exa Networks Ltd? Who?? What???

[Ripshod]

It's not often I ask for thoughts but this is bugging me now.

For a good few months I've been running DoT, blissfully unaware of any problems since I ran a DNS leak test when I first set my router up and saw nothing but WoodyNet serrvers (UK Quad9 provider). Ran a leak test today and I see Exa Networks Ltd intercepting my DNS requests. I could have asked on snbforums but this is a n issue outside of firmware and hardware, and I believe ISP related. But how are they doing this.

Pushing  my connection through a London VPN and Exa disappear, but as soon as I drop the vpn they're back.. Who, what, how, when and why?

*Mods - don't delete, there is no personal info or security info in this image*

[CrimsonLiar · Accepted solution]

Exa networks provide the Quad9 infrastructure in some dominions - it is not an intercept!

[Ripshod]

Thanks. I've never seen them before and I couldn't find any info on them. Better to be safe eh? 

[CrimsonLiar]

Yup!  If you have a VPN then try relocating yourself to different places and perform the same tests, you'll find that both Quad9 and AdGuard use some dodgily named connections!

[Ripshod]

The reason I was suspitious was there was nothing that I could find to link them with quad9. 

If you Google 'quad9 dns WoodyNet' you get confirmation if the link. Nothing for exa other than normal daily business.

I use my own VPN on a VPS in London, saves me plenty 😁